Go/github.com/zitadel/zitadel CVE-2026-56665: unknown, EPSS 0.27%

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider in github.com/zitadel/zitadel

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6469
• https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx
• https://nvd.nist.gov/vuln/detail/CVE-2026-56665
• https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8
• https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac
• https://github.com/zitadel/zitadel/releases/tag/v3.4.12
• https://github.com/zitadel/zitadel/releases/tag/v4.15.2

CVE-2026-56665 · published 2026-09-16T16:56:22Z · modified 2026-09-17T17:30:12.898388213Z · JSON